Are these permissions appropriate? I'd have thought these shouldn't be world-readable, likewise for `ssl_trusted_certificate`